Which versions of WWBN AVideo are affected by CVE-2026-47696?

WWBN AVideo 29.0 and earlier contains a wallet balance forgery vulnerability allowing any authenticated user to credit their account with arbitrary funds by bypassing payment validation, creating…. A patch is available.

Is there a public PoC exploit available for CVE-2026-47696?

Yes, a public proof-of-concept exploit is available for CVE-2026-47696. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-47696?

Within 24 hours: Disable the /plugin/AuthorizeNet/processPayment.json.php endpoint via web application firewall rule or uninstall the AuthorizeNet plugin entirely; audit all wallet balance changes from past 30 days for suspicious additions. Within 7 days: Implement transaction-level logging and automated alerts for any wallet.addBalance() calls; restrict AuthorizeNet plugin configuration access to administrator role only; require manual two-factor approval for wallet credits exceeding $100 or your organization's fraud threshold. Within 30 days: Upgrade to patched WWBN AVideo version once released (subscribe to WWBN security advisories); evaluate alternative payment processors with server-side transaction validation; conduct full forensic review of historical wallet transactions to quantify fraud exposure.

WWBN AVideo CVE-2026-47696

Q: What is the CVSS score of CVE-2026-47696?

CVE-2026-47696 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33303 HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-05-29 GitHub_M

GHSA-9392-pj54-qqf8

RCE PHP Avideo

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:31 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

7.1 (HIGH)

DescriptionCVE.org

WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance() without validating any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record. This allows any logged-in user to add arbitrary funds to their own AVideo wallet when the AuthorizeNet and YPTWallet plugins are enabled.

AnalysisAI

Wallet balance forgery in WWBN AVideo 29.0 and earlier allows any authenticated user to credit their own wallet with arbitrary funds by abusing an unfinished AuthorizeNet payment handler. The plugin/AuthorizeNet/processPayment.json.php endpoint hardcodes payment success and calls YPTWallet::addBalance() using an attacker-supplied amount with no validation of the underlying Authorize.Net transaction. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible from a logged-in account.

Technical ContextAI

WWBN AVideo is an open-source PHP-based video platform (CPE cpe:2.3:a:wwbn:avideo) that supports a plugin ecosystem including the AuthorizeNet payment integration and the YPTWallet stored-balance system. The vulnerability sits in plugin/AuthorizeNet/processPayment.json.php, where the developer left a TODO placeholder for the real Authorize.Net charge logic and instead hardcoded $paymentSuccess = true before invoking YPTWallet::addBalance() with the client-supplied amount parameter. The root cause maps to CWE-345 (Insufficient Verification of Data Authenticity): the server treats an attacker-controlled HTTP POST value as proof of payment without verifying any transaction ID, webhook signature, hosted payment token, nonce, or server-side payment record against Authorize.Net.

RemediationAI

No vendor-released patched version was identified at time of analysis; consult GHSA-9392-pj54-qqf8 at https://github.com/WWBN/AVideo/security/advisories/GHSA-9392-pj54-qqf8 for the upstream fix status and upgrade once a tagged release supersedes 29.0. As an immediate compensating control, disable the AuthorizeNet plugin in the AVideo admin panel (which removes the vulnerable endpoint entirely at the cost of losing Authorize.Net as a payment method), or disable the YPTWallet plugin so addBalance() cannot be reached (which breaks any stored-balance features). If neither plugin can be turned off, block external access to plugin/AuthorizeNet/processPayment.json.php at the web server or WAF, restrict it to known internal callers, and audit YPTWallet transaction logs and wallet balances for unexpected credits since the plugins were enabled; locally patch processPayment.json.php to remove the hardcoded $paymentSuccess = true and reject requests that lack a server-verified Authorize.Net transaction ID.